How do I use Publish Control?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Publish Control run a full publish security scan on this repo and show my score" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Publish Control

by EthYusuf

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

🛡️ Publish Control

Pre-publish security & code quality analysis MCP server for AI coding assistants (Google Antigravity, Cursor, Claude Desktop, Codex).

Publish Control, yapay zeka kodlama asistanları ile geliştirilen projeleri yayına almadan önce 17 farklı güvenlik ve mimari kategorisinde otomatik analizden geçiren, açık kaynaklı bir Model Context Protocol (MCP) sunucusudur.

🎯 17 Güvenlik & Kalite Denetim Modülü

AI asistanınıza /publish-control yazdığınızda sistem aşağıdaki 17 kontrolü eşzamanlı çalıştırır:

No	Modül	İkon	Açıklama	Seviye
1	Secrets Detection	🔑	AWS, Stripe, GitHub, JWT, Google API anahtarları ve Shannon entropi analizi	`CRITICAL`
2	Environment Security	📁	`.env` dosyalarının gitignore durumu, açıkta kalan anahtarlar ve fallback riskleri	`CRITICAL` / `HIGH`
3	Injection Protection	💉	SQL string concat, NoSQL (`$where`), komut çalıştırma (`exec`), XSS kontrolleri	`CRITICAL` / `HIGH`
4	Auth & Authorization	🔒	JWT `none` algoritması, zayıf hashler (MD5/SHA1), yetkisiz Express rotaları	`CRITICAL` / `HIGH`
5	Server Config Audit	🌐	`0.0.0.0` dinleme, açık debug bayrakları, eksik Helmet koruması	`HIGH` / `MEDIUM`
6	CORS Misconfiguration	🛡️	Wildcard (`*`) origin, `credentials: true` çakışması	`HIGH` / `CRITICAL`
7	HTTPS / TLS Security	🔐	`rejectUnauthorized: false`, düz HTTP dış istekleri	`CRITICAL` / `HIGH`
8	Path Traversal	📂	`path.join`/`fs` çağrılarında kullanıcı girdisiyle dizin dışına çıkma	`CRITICAL`
9	SSRF Detection	🌍	Kullanıcı kontrollü URL istekleri, `169.254.169.254` bulut metadata sızıntısı	`CRITICAL` / `HIGH`
10	Docker Security	🐳	`USER root`, `:latest` tag, `privileged: true`, `.dockerignore` denetimi	`HIGH` / `MEDIUM`
11	Dependency Audit	📦	Eksik lockfile (`package-lock.json`), wildcard (`*`) versiyonlar, riskli paketler	`HIGH` / `MEDIUM`
12	Rate Limiting	⚡	Brute-force ve DoS risklerine karşı rate limiter koruma eksikliği	`MEDIUM` / `HIGH`
13	File Permissions	🗂️	`chmod 777` kullanımı, filtresiz dosya yükleme (multer)	`HIGH` / `MEDIUM`
14	Error Handling	❌	Stack trace sızıntısı, istemciye çiğ hata objesi dönülmesi	`MEDIUM`
15	Sensitive Logging	📝	`console.log` ile şifre, token ve request body yazdırılması	`MEDIUM` / `HIGH`
16	Security Config	🔧	Eksik `httpOnly` çerez bayrakları, TypeScript strict mod eksikliği	`MEDIUM` / `HIGH`
17	Code Quality Hygiene	📊	`@ts-ignore` aşırılığı, çözülmemiş güvenlik TODO/FIXME notları, `any` kirliliği	`LOW` / `MEDIUM`

Related MCP server: Security-Use MCP Server

🛠️ Sunulan MCP Araçları (Tools)

publish_control: 17 kategoride tam tarama yapar, 0-100 güvenlik skoru ve görsel Markdown raporu üretir.
publish_control_quick: Sadece en kritik güvenlik açıklarını (Secrets, Env, Injection, Auth, Server) hızla inceler.
publish_control_fix: Tespit edilen herhangi bir bulgunun ID'sine (ör. SEC-001, INJ-002) göre kod düzeltme ve refactor önerisi verir.

🚀 Hızlı Başlangıç

1. Kurulum & Derleme

git clone https://github.com/EthYusuf/publish-control.git
cd publish-control
npm install
npm run build

2. İstemcinize MCP Konfigürasyonunu Ekleyin

Google Antigravity

~/.gemini/config/mcp_config.json:

{
  "mcpServers": {
    "publish-control": {
      "command": "node",
      "args": ["<PATH_TO_PUBLISH_CONTROL>/dist/index.js"]
    }
  }
}

Cursor IDE

~/.cursor/mcp.json veya .cursor/mcp.json:

{
  "mcpServers": {
    "publish-control": {
      "command": "node",
      "args": ["<PATH_TO_PUBLISH_CONTROL>/dist/index.js"]
    }
  }
}

Claude Desktop

%APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "publish-control": {
      "command": "node",
      "args": ["<PATH_TO_PUBLISH_CONTROL>\\dist\\index.js"]
    }
  }
}

🧪 Testleri Çalıştırma

npm test

📄 Lisans

Bu proje MIT Lisansı altında lisanslanmıştır.

Available Tools

3 tools

publish_controlB

Projedeki tüm kodları 17 farklı güvenlik kategorisinde analiz eder. Hardcoded secrets, env güvenliği, server açıkları, SQL/NoSQL injection, authentication, dependency güvenliği, Docker, CORS, SSRF, path traversal, HTTPS/TLS, rate limiting, dosya izinleri, error handling, logging, güvenlik konfigürasyonu ve kod kalitesi kontrolleri yapar. Yayına almadan önce kapsamlı güvenlik raporu üretir.

Name	Required	Description	Default
`severity`	No	Minimum severity filtresi	all
`categories`	No	Sadece belirli kategorileri çalıştır. Mevcut: secrets, env, injection, auth, server, cors, https, path, ssrf, docker, deps, rate-limit, permissions, error, logging, config, quality
`projectPath`	Yes	Taranacak projenin kök dizini (absolute path)

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full behavioral burden. It says the tool analyzes code and produces a report, but it does not state whether it is read-only, whether it modifies files, what permissions are needed, or what the report output looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded, and the category list is relevant for understanding scope. The description is somewhat verbose because it enumerates categories that also appear in the schema, but it remains focused and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers the scan scope and report purpose, but with no output schema and no annotations, the definition leaves important gaps: report format, whether the scan is read-only, and how it relates to the quick and fix siblings. It is adequate but not complete for a tool with this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented in the schema. The description mentions the 17 categories and the pre-release report context, but it adds no parameter-specific semantics such as how to combine severity and categories. A baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (analyze all code in the project), scope (17 security categories), and output (a comprehensive security report before release). It is clear what the tool does, but it does not explicitly differentiate itself from the sibling tools publish_control_quick and publish_control_fix.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies the tool should be used before publishing/deployment to get a comprehensive security report. However, it gives no explicit guidance on when to choose it over publish_control_quick or publish_control_fix, and it does not state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publish_control_fixA

Belirli bir güvenlik bulgusu için detaylı düzeltme önerileri ve kod örnekleri üretir. Önce publish_control ile tarama yapın, ardından bulgu ID'si ile düzeltme önerisi alın.

Name	Required	Description	Default
`findingId`	Yes	Düzeltilecek bulgunun ID'si (ör: SEC-001)
`projectPath`	Yes	Proje kök dizini

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral load. It usefully discloses the prerequisite relationship and that the response contains remediation advice plus code snippets, but says nothing about whether anything is written to disk, what permissions are needed, or how large/costly the generation is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the capability first, the workflow second. Nothing is redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, non-mutating generator with no output schema, the description covers purpose, prerequisite and return content. The only real gap is the absence of any safety or side-effect statement, which would matter more if this tool touched files.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters carry their own descriptions (including an example ID like SEC-001). The description only restates that a finding ID is supplied, adding no semantics beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: generating detailed fix suggestions and code samples for a given security finding. The prerequisite scan tool is named, which separates it from the detection siblings, though it never explicitly contrasts itself with publish_control_quick.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit ordered workflow: run publish_control first, then call this with the finding ID. That is clear when-to-use guidance, but there are no exclusions and the second sibling (publish_control_quick) is never addressed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publish_control_quickA

Sadece CRITICAL ve HIGH seviye kontrolleri çalıştırır. Secrets, env exposure, injection ve auth gibi en kritik kontrolleri yapar. Hızlı güvenlik değerlendirmesi için kullanılır.

Name	Required	Description	Default
`projectPath`	Yes	Taranacak projenin kök dizini

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description must carry the behavioral load. It highly successfully communicates the limited depth of the scan—specifically targeting only CRITICAL/HIGH severities and mentioning core checks like auth and injection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly efficient, front-loading the critical scope limitation before listing specific checks and concluding with the overall use case.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 'quick' scanning tool, the definition is contextually complete. The agent knows exactly what security coverage it can expect and when it should choose this over a full scan.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing a high baseline. The description does not add specific semantics to the single parameter ('projectPath'), but it successfully frames the context in which that path is evaluated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs security checks (e.g., Secrets, injection) and critically, defines its scope as running only CRITICAL and HIGH level controls, distinguishing it from a full scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states its intended use ('Hızlı güvenlik değerlendirmesi için kullanılır'), positioning it as a quick alternative to more comprehensive tools like publish_control.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

3 tool updatesv1.0.0Oct 25, 2026
- First observedpublish_control
- First observedpublish_control_fix
- First observedpublish_control_quick

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored 2026-10-25 16:40 across 3 tools

Disambiguation4/5

The three tools have distinct roles: a full 17-category scan, a critical/high-only fast scan, and a per-finding remediation helper. The only mild overlap is between publish_control and publish_control_quick, but the descriptions make the scope difference (comprehensive vs CRITICAL/HIGH only) explicit.

Naming Consistency4/5

All tools share a single predictable prefix ('publish_control') with consistent snake_case suffixes (_quick, _fix). The base tool carries no verb, so the pattern is more 'namespace + variant' than verb_noun, but it is internally consistent and readable.

Tool Count4/5

Three tools cover the realistic modes of a pre-deploy security gate: full audit, fast check, and fix guidance. It is on the lean side but each tool has a clear reason to exist rather than being redundant padding.

Completeness3/5

The scan-to-fix lifecycle is present, but there is no standalone way to list or re-query findings, filter by category or severity, export/report results, or suppress/baseline known issues. publish_control_fix also has a hard dependency on finding IDs that only appear in scan output, creating a potential dead end.

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

Related MCP Connectors

SafeWeaveOAuth
dev.safeweave
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Code Analysis Penetration Testing Security
14
https://mcp.safeweave.dev/mcp
Opzyai Pro
com.opzyai
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Code Analysis Penetration Testing Security
2
https://www.opzyai.com/api/mcp/pro/mcp
Frogeye Security Scanner A
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
https://mcp.frogeye.ai/mcp
SecScan A
us.secscan
Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.
Penetration Testing Security Monitoring
121
https://secscan.us/api/mcp

Related MCP Servers

Security MCP Server
Security Code Analysis Testing & QA Tools
michoo
A
license
Not graded
quality
D
maintenance
Enables security scanning of codebases through integrated tools for secret detection, SCA, SAST, and DAST vulnerabilities, with AI-powered remediation suggestions based on findings.
Updated 4 months ago (2026-06-10 21:59 UTC)
MIT
Security-Use MCP Server
Security Testing & QA Tools Developer Tools
security-use
A
license
A
quality
D
maintenance
Enables AI assistants to scan project dependencies and Infrastructure as Code files for security vulnerabilities and misconfigurations. It also provides automated fixing capabilities to remediate identified security issues.
Updated 8 months ago (2026-03-01 13:30 UTC)
18
3
MIT
Cybrium MCP Serverofficial
Penetration Testing Code Analysis
cybrium-ai
A
license
Not graded
quality
B
maintenance
Provides AI coding assistants with real-time security scanning superpowers, including SAST, secrets detection, dependency CVE scanning, and web vulnerability assessment.
Updated 2 months ago (2026-09-01 04:11 UTC)
5 npm
Apache 2.0
CodeMore MCP Server
Code Analysis Developer Tools
abhinavteja123
A
license
Not graded
quality
C
maintenance
Enables AI agents to scan code for security and quality issues and receive machine-readable reports with suggested fixes and verification criteria.
Updated 3 months ago (2026-07-18 16:29 UTC)
53 npm
2
MIT

🛡️ Publish Control

🎯 17 Güvenlik & Kalite Denetim Modülü

🛠️ Sunulan MCP Araçları (Tools)

🚀 Hızlı Başlangıç

1. Kurulum & Derleme

2. İstemcinize MCP Konfigürasyonunu Ekleyin

Google Antigravity

Cursor IDE

Claude Desktop

🧪 Testleri Çalıştırma

📄 Lisans

Available Tools

TDQS

TDQS

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Security MCP Server

Security-Use MCP Server

Cybrium MCP Serverofficial

CodeMore MCP Server